This is a note to let you know that I've just added the patch titled tcp: fix over estimation in sk_forced_mem_schedule() to the 5.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch and it can be found in the queue-5.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From c4ee118561a0f74442439b7b5b486db1ac1ddfeb Mon Sep 17 00:00:00 2001 From: Eric Dumazet <edumazet@xxxxxxxxxx> Date: Tue, 14 Jun 2022 10:17:33 -0700 Subject: tcp: fix over estimation in sk_forced_mem_schedule() From: Eric Dumazet <edumazet@xxxxxxxxxx> commit c4ee118561a0f74442439b7b5b486db1ac1ddfeb upstream. sk_forced_mem_schedule() has a bug similar to ones fixed in commit 7c80b038d23e ("net: fix sk_wmem_schedule() and sk_rmem_schedule() errors") While this bug has little chance to trigger in old kernels, we need to fix it before the following patch. Fixes: d83769a580f1 ("tcp: fix possible deadlock in tcp_send_fin()") Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx> Acked-by: Soheil Hassas Yeganeh <soheil@xxxxxxxxxx> Reviewed-by: Shakeel Butt <shakeelb@xxxxxxxxxx> Reviewed-by: Wei Wang <weiwan@xxxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/ipv4/tcp_output.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -3367,11 +3367,12 @@ void tcp_xmit_retransmit_queue(struct so */ void sk_forced_mem_schedule(struct sock *sk, int size) { - int amt; + int delta, amt; - if (size <= sk->sk_forward_alloc) + delta = size - sk->sk_forward_alloc; + if (delta <= 0) return; - amt = sk_mem_pages(size); + amt = sk_mem_pages(delta); sk->sk_forward_alloc += amt * SK_MEM_QUANTUM; sk_memory_allocated_add(sk, amt); Patches currently in stable-queue which might be from edumazet@xxxxxxxxxx are queue-5.18/batman-adv-tracing-use-the-new-__vstring-helper.patch queue-5.18/epoll-autoremove-wakers-even-more-aggressively.patch queue-5.18/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch queue-5.18/tcp-fix-possible-freeze-in-tx-path-under-memory-pres.patch queue-5.18/raw-fix-a-typo-in-raw_icmp_error.patch queue-5.18/inet-add-read_once-sk-sk_bound_dev_if-in-inet_match.patch queue-5.18/raw-convert-raw-sockets-to-rcu.patch queue-5.18/raw-use-more-conventional-iterators.patch queue-5.18/ax25-fix-incorrect-dev_tracker-usage.patch queue-5.18/tracing-events-add-__vstring-and-__assign_vstr-helpe.patch queue-5.18/ipv6-add-read_once-sk-sk_bound_dev_if-in-inet6_match.patch queue-5.18/tcp-make-retransmitted-skb-fit-into-the-send-window.patch queue-5.18/net-rose-fix-netdev-reference-changes.patch queue-5.18/raw-remove-unused-variables-from-raw6_icmp_error.patch queue-5.18/net-fix-sk_wmem_schedule-and-sk_rmem_schedule-errors.patch